Extracted

• • Target
    6034fb4eac9ce0bfaa6f77c903f761193792c980e0a9f24d1069d7db889ff508
  • Size 151KB
  • SHA256 6034fb4eac9ce0bfaa6f77c903f761193792c980e0a9f24d1069d7db889ff508
  • MD5 06ffd3e83763aeb541a699f7b007deb4
  • SHA1 5b230616498801b020b540504060865fce5dba34
  • SHA512 88a471d7e151234a0e6b62cc294bbfa7e42bafeaf2637e157caffbcdbed008ae7f535487899be233f42b25f23a2d7835fccaa836b936ac1b73f9f31f43b5c765
  • SSDEEP 3072:fZ0x9lUwCedjVTLF9CsE1KKAORUMHmA5UDXVdq:fZWlUwCSxn7MDTVSq
  • TLSH
    T18DE3B71837E5160AF7BFEA712EB59140477BBDD2C935C32D798071AD0AB2684CE11BB2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessspywarestealer

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2